A computer virus is a self-replicating program designed to spread without user intervention or knowledge. Computer viruses are spread by attaching themselves to another program, such as a macro attached to e-mail. A worm is a type of computer virus that can transmit itself to a second computer over a network. The increased access to e-mail at the workplace has allowed viruses and worms to spread at a much faster rate. The number of viruses “in the wild,” or present in more than one company or organization, has increased dramatically since widespread Internet access has become available.
Most companies allow Internet access by creating a local area network (LAN). Access to the LAN by the Internet is protected by a “firewall”. Such a network allows programs on one computer to be accessed by all the computers on the LAN. Unfortunately, this access means that once a virus infects one computer, all the other computers in a LAN may soon be infected as well.
The standard protection against virus is an anti-virus software application that analyzes software applications and isolates any latent viruses. This anti-virus software has a set of virus characteristics that the software searches for in the computer. Each time a new virus is created or evolved, a new anti-virus characteristic must be updated to the computer in order for the anti-virus software to detect the virus.
In general, anti-virus software may be installed directly into the firewall of a gateway device. The firewall attempts to scan for viruses on the fly while the client computer is receiving the data and then aborts the transfer if a virus is detected. However, when the anti-virus software detects that the data contains a virus, a portion of the data has already been received by the client. When the connection is terminated, the client would not know the reasons behind the termination of the connection (e.g., because of a virus).